I still wonder how this law doesn't go against individual rights provided by the Constitution or other fundamental laws.
Either way this law is hilariously clueless and extremely worrying at the same time.
Not that I think this will work—it wont in the long run—but I'd rather argue against the strongest case of an argument.
A person is a designated communications provider if ...
6. the person develops, supplies or updates software used, for use, or likely to be used, in connection with:
(a) a listed carriage service; or
(b) an electronic service that has one or more end-users in Australia
... and the eligible activities of the person are ...
(a) the development by the person of any such software; or
(b) the supply by the person of any such software; or
(c) the updating by the person of any such software
Look at it from their point of view... they approach some developer and it's amateur hour. The dev might get stroppy, there's all sorts of infrastructure problems, they might not do it right... it's a mess.
But if they approach the CEO, it gets done right. The CEO brings in Legal, who promptly shit themselves. They bring in the CTO, who is told to shut up, sign this NDA, and work out how to make this happen as fast and painlessly as possible. No problems, the bad things get done, no-one gets told anything, all good. Shit continues to roll downhill...
Also, if you were an employee in a company in this situation, and you'd been told that the security of the nation depended on your silence, and more to the point, you'd be locked up and your career ruined if you went public, what would you do? Whistleblowers are pretty rare, because the consequences of doing that are huge.
Companies, of course, are already cooperating. For petes sake, all you need to do is talk to a couple of admins in the Bay Area to know what alphabet soup are visiting what companies (pro tip: basically all of them).
The real problem is that the law allows them to ask an individual to become a saboteur and it's unclear if you had a system that was explicitly resilient to such attacks (signed GPLv3 code with a threshold signing scheme with each key owned by people under different jurisdictions) whether you would be forced to dismantle such a system.
I think we'll need to start rethinking threat models.
One well documented[2] example where individuals were "tasked" (spy on) directly is the compromise of satellite ISP Stellar:
> The document lists "key staff" at the company. The document states they should be identified and "tasked." "Tasking" somebody in signals intelligence jargon means that they are to be targeted for surveillance. In addition to CEO Christian Steffen, nine other employees are named in the document.
The shock on the IT chief's face[4] when he saw his name in an NSA document...
[1] https://en.wikipedia.org/wiki/Bullrun_%28decryption_program%...
[2] https://www.mail-archive.com/[email protected]/msg12...
[3] http://www.spiegel.de/international/world/snowden-documents-...
[4] http://www.spiegel.de/video/chokepoint-the-moment-stellar-le...
If the Govt strongarms a developer into implanting a backdoor, they won't care that they can't do it without breaking company policy or QA or workflow or even the law, because they cease to be primarily an employee, and become an asset of ASIO.
Sure, this strategy may work in China but Australia is a Western nation where freedom is taken seriously.
Edit later: by 'freedom taken seriously I mean by the people, not by the government.'
That’s the carefully cultivated reality distortion field at work.
It may look that way from the outside, but it’s a tightly controlled, aging and fearful society. Anyone who steps out of line is dealt with harshly and swiftly. The government may loosen the leash on those who align with their political philosophy (so figures who vilify vulnerable groups are given a bit of freedom under the current government) but the jackboot of the state isn’t far away.
Re your edit: there is compulsory voting, so the people obviously like it that way.
Ahahahahahahaha
Oh, you sweet summer child.
In reality, they issue a notice to the company, give them a timeframe, and expect it to be done. They don’t care about the intricacies of git.